5 Configuring Active Directory Integration

5.1 Setting up a Plug-in to Augment Active Directory Entries for Linux Authentication

User entries in Active Directory do not include key information required for Linux authentication. Therefore, when you synchronize users from Active Directory into Oracle Internet Directory by using the Active Directory connector of Oracle Directory Integration Platform, you must augment those user entries with the required information. To facilitate this, the product includes a PL/SQL plug-in that can be enabled on Oracle Internet Directory.

Enable the plug-in as follows:

1. Use a text editor to make the following changes to $ORACLE_HOME/ldap/admin/posixattr_when_add.pls:

   • In line 71, replace the value of v_homeDirectory with the desired home directory.

   • In line 72, replace the value of v_loginShell with the desired login shell.

   • In line 73, replace the value of v_gidNumber with the GID number of the users

2. Load the plug-in package into the database by typing:

   sqlplus ods/odspwd@$ORACLE_HOME/ldap/admin/posixattr_when_add.pls 
   

   where odspwd is the password of the ODS user.

3. Use a text editor to make the following change in $ORACLE_HOME/ldap/admin/posixattr_when_add.ldif: Replace the value of orclpluginsubscriberdnlist with your realm's DN.

4. Add the plug-in to Oracle Internet Directory by running the following command:

   ldapadd  -h host -p port -D cn=orcladmin -q \
            -f $ORACLE_HOME/ldap/admin/posixattr_when_add.ldif
   

5.2 Configuring Oracle Directory Integration Platform

Oracle Directory Integration Platform is documented in the Oracle Fusion Middleware Administrator's Guide for Oracle Directory Integration Platform. The following procedure refers to that document in several places.

To enable Oracle Directory Integration Platform for Active Directory integration with Oracle Authentication Services for Operating Systems, perform these steps:

1. Verify the synchronization requirements, as described in "Verifying Synchronization Requirements," under "Configuring Synchronization with a Third-Party Directory," in Chapter 18 of the Oracle Fusion Middleware Administrator's Guide for Oracle Directory Integration Platform.

2. Create a synchronization profile by running expressSyncSetup, as described in the section "Creating Import and Export Synchronization Profiles Using expressSyncSetup" in the chapter entitled "Creating Synchronization Profiles with Express Configuration" inOracle Fusion Middleware Administrator's Guide for Oracle Directory Integration Platform.

3. Edit the profiles resulting from the express configuration. To understand mapping rules, see: "Configuring Mapping Rules," in Chapter 6 of the Oracle Fusion Middleware Administrator's Guide for Oracle Directory Integration Platform.

   Make the following changes:

   1. Change the domain rules to point to ou=People under the realm DN: ou=People,<realm DN> in Oracle Internet Directory.

   2. Provide a DN mapping rule: uid=%,ou=People,<realm DN>

   3. Comment out this line:

      userPrincipalName: : :user:uid: :inetorgperson:userPrincipalName
      

   4. Uncomment this line:

      #sAMAccountName: : :user:uid: :inetorgperson
      

   See the sample synchronization profile in Appendix D. The customizations are shown in boldface.

4. Continue with Steps 2-5 of "Creating Synchronization Profiles with Express Configuration," under "Configuring Synchronization with a Third-Party Directory," in Chapter 18 of the Oracle Fusion Middleware Administrator's Guide for Oracle Directory Integration Platform.

5.3 Configuring External Authentication Plug-ins

You must configure external authentication plug-ins for authenticating users synchronized from AD. The procedure for doing this is documented in the "Configuring External Authentication Plug-ins" section of Oracle Fusion Middleware Administrator's Guide for Oracle Directory Integration Platform.